<!DOCTYPE html>
<html lang="en">
  <head>
    <link rel="stylesheet" type="text/css" href="/css/style.css?v=18" />
    <link rel="stylesheet" type="text/css" href="/css/fontello.css?v=2" />
    <link rel="stylesheet" type="text/css" href="/css/themes/nitter.css" />
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
    <link rel="manifest" href="/site.webmanifest" />
    <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#ff6c60" />
    <link rel="search" type="application/opensearchdescription+xml" title="nitter" href="https://nitter.net/opensearch" />
    <link rel="canonical" href="https://twitter.com/Alh4zr3d/status/1577649651376791552" />
    <title>Alh4zr3d (@Alh4zr3d): &quot;Red Teamers, few Linux tips today:

Disable history (do first) -
&quot;export HISTFILE=&#x2F;dev&#x2F;null&quot;

Hide a command by masking it as syslogd -
&quot;(exec -a syslogd nmap -T0 10.0.2.1&#x2F;24)&quot;

Start a background hidden process as syslogd -
&quot;exec -a syslogd nmap -T0 10.0.2.1&#x2F;24 &amp;&gt;nmap.log &amp;&quot;&quot;|nitter</title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta name="theme-color" content="#1F1F1F" />
    <meta property="og:type" content="article" />
    <meta property="og:title" content="Alh4zr3d (@Alh4zr3d)" />
    <meta property="og:description" content="Red Teamers, few Linux tips today:

Disable history (do first) -
&quot;export HISTFILE=/dev/null&quot;

Hide a command by masking it as syslogd -
&quot;(exec -a syslogd nmap -T0 10.0.2.1/24)&quot;

Start a background hidden process as syslogd -
&quot;exec -a syslogd nmap -T0 10.0.2.1/24 &amp;&gt;nmap.log &amp;&quot;" />
    <meta property="og:site_name" content="Nitter" />
    <meta property="og:locale" content="en_US" />
    <link rel="preload" type="font/woff2" as="font" href="/fonts/fontello.woff2?21002321" crossorigin="anonymous" />
  </head>
  <body>
    <nav><div class="inner-nav">
        <div class="nav-item"><a class="site-name" href="/">nitter</a></div>
        <a href="/"><img class="site-logo" src="/logo.png" alt="Logo" /></a>
        <div class="nav-item right">
          <div class="icon-container"><a class="icon-search" title="Search" href="/search"></a></div>
          <div class="icon-container"><a class="icon-bird" title="Open in Twitter" href="https://twitter.com/Alh4zr3d/status/1577649651376791552"></a></div>
          <a href="https://liberapay.com/zedeus"><svg class="lp" viewBox="0 0 40.6 52.3">
  <g transform="matrix(0.83,0,0,0.83,-158,-261)">
    <path d="m202.5,366c-3.1 0-5.5-0.4-7.3-1.2-1.8-0.8-3-1.9-3.8-3.3-0.8-1.4-1.1-3-1.1-4.8 0-1.8 0.3-3.7 0.8-5.8l8.3-34.8 10.2-1.6-9.1 37.8c-0.2 0.8-0.3 1.5-0.3 2.2 0 0.7 0.1 1.2 0.4 1.7 0.3 0.5 0.7 0.9 1.3 1.2 0.6 0.3 1.5 0.5 2.7 0.6l-2 8.1"/>
    <path d="m239.2 344.3c0 3.2-0.5 6.1-1.6 8.8-1 2.6-2.5 4.9-4.4 6.9-1.9 1.9-4.1 3.4-6.7 4.5-2.6 1.1-5.4 1.6-8.5 1.6-1.5 0-3-0.1-4.5-0.4l-3 11.9h-9.7l10.9-45.4c1.7-0.5 3.7-1 6-1.4 2.3-0.4 4.7-0.6 7.3-0.6 2.4 0 4.6 0.4 6.3 1.1 1.8 0.7 3.2 1.8 4.4 3 1.1 1.3 2 2.8 2.5 4.5 0.5 1.7 0.8 3.6 0.8 5.5m-23.8 13.4c0.7 0.2 1.7 0.3 2.8 0.3 1.7 0 3.3-0.3 4.7-1 1.4-0.6 2.6-1.5 3.6-2.7 1-1.1 1.7-2.5 2.3-4.1 0.5-1.6 0.8-3.4 0.8-5.3 0-1.9-0.4-3.5-1.2-4.8-0.8-1.3-2.3-2-4.3-2-1.4 0-2.7 0.1-3.9 0.4l-4.6 19.1"/>
  </g>
</svg>
</a>
          <div class="icon-container"><a class="icon-info" title="About" href="/about"></a></div>
          <div class="icon-container"><a class="icon-cog" title="Preferences" href="/settings?referer=%2FAlh4zr3d%2Fstatus%2F1577649651376791552%23m"></a></div>
        </div>
      </div></nav>
    <div class="container"><div class="conversation">
        <div class="main-thread"><div id="m" class="main-tweet"><div class="timeline-item "><div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/Alh4zr3d"><img class="avatar round" src="/pic/profile_images%2F1261794478450331648%2FBAyT3XZw_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/Alh4zr3d" title="Alh4zr3d">Alh4zr3d</a>
                        <a class="username" href="/Alh4zr3d" title="@Alh4zr3d">@Alh4zr3d</a>
                      </div>
                      <span class="tweet-date"><a href="/Alh4zr3d/status/1577649651376791552#m" title="Oct 5, 2022 · 1:19 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Red Teamers, few Linux tips today:

Disable history (do first) -
"export HISTFILE=/dev/null"

Hide a command by masking it as syslogd -
"(exec -a syslogd nmap -T0 10.0.2.1/24)"

Start a background hidden process as syslogd -
"exec -a syslogd nmap -T0 10.0.2.1/24 &amp;&gt;nmap.log &amp;"</div>
                <p class="tweet-published">Oct 5, 2022 · 1:19 PM UTC · Twitter Web App</p>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 40</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 483</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 12</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 2,172</div></span>
                </div>
              </div></div></div></div>
        <div id="r" class="replies">
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/SEC_Tay/status/1577650205767376896#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/SEC_Tay"><img class="avatar round" src="/pic/profile_images%2F1060516681724899329%2F7VPYnXF1_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/SEC_Tay" title="Tay">Tay</a>
                        <a class="username" href="/SEC_Tay" title="@SEC_Tay">@SEC_Tay</a>
                      </div>
                      <span class="tweet-date"><a href="/SEC_Tay/status/1577650205767376896#m" title="Oct 5, 2022 · 1:21 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/Alh4zr3d">@Alh4zr3d</a></div>
                <div class="tweet-content media-body" dir="auto">Nice! You are always dropping good ones for the community</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 3</div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/xenosCR/status/1577654369952190464#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/xenosCR"><img class="avatar round" src="/pic/profile_images%2F1090793638617968640%2FJ4EkO8Dv_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/xenosCR" title="Conor Richard">Conor Richard</a>
                        <a class="username" href="/xenosCR" title="@xenosCR">@xenosCR</a>
                      </div>
                      <span class="tweet-date"><a href="/xenosCR/status/1577654369952190464#m" title="Oct 5, 2022 · 1:38 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/Alh4zr3d">@Alh4zr3d</a></div>
                <div class="tweet-content media-body" dir="auto">Add a space in front of your commands to keep them from being added to the history file.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 3</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 2</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 78</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/Alh4zr3d/status/1577656096457560069#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/Alh4zr3d"><img class="avatar round" src="/pic/profile_images%2F1261794478450331648%2FBAyT3XZw_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/Alh4zr3d" title="Alh4zr3d">Alh4zr3d</a>
                        <a class="username" href="/Alh4zr3d" title="@Alh4zr3d">@Alh4zr3d</a>
                      </div>
                      <span class="tweet-date"><a href="/Alh4zr3d/status/1577656096457560069#m" title="Oct 5, 2022 · 1:44 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Another excellent tip!</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 13</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item more-replies"><a class="more-replies-text" href="/Alh4zr3d/status/1577656096457560069#m">more replies</a></div>
          </div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/secitguy/status/1577667076835217408#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/secitguy"><img class="avatar round" src="/pic/profile_images%2F1338925104768675845%2F65YHyO2G_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/secitguy" title="Jack Reedy">Jack Reedy</a>
                        <a class="username" href="/secitguy" title="@secitguy">@secitguy</a>
                      </div>
                      <span class="tweet-date"><a href="/secitguy/status/1577667076835217408#m" title="Oct 5, 2022 · 2:28 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/Alh4zr3d">@Alh4zr3d</a></div>
                <div class="tweet-content media-body" dir="auto">Love reading your stuff from an operations perspective. Can't wait to write a rule to check Linux settings for "HISTFILE=/dev/null"  on my next threat hunt.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 7</div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/s4nsec/status/1577671886602903552#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/s4nsec"><img class="avatar round" src="/pic/profile_images%2F1399140577887784960%2F6WYTSJ5p_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/s4nsec" title="Sanan Hasanov">Sanan Hasanov</a>
                        <a class="username" href="/s4nsec" title="@s4nsec">@s4nsec</a>
                      </div>
                      <span class="tweet-date"><a href="/s4nsec/status/1577671886602903552#m" title="Oct 5, 2022 · 2:47 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/Alh4zr3d">@Alh4zr3d</a> <a href="/N4k3dTurtl3">@N4k3dTurtl3</a></div>
                <div class="tweet-content media-body" dir="auto"><a href="/SaveToNotion" title="Save to Notion ">@SaveToNotion</a> <a href="/search?q=%23redteam">#redteam</a> <a href="/search?q=%23linux">#linux</a></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/lowmal3/status/1577709708269469697#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/lowmal3"><img class="avatar round" src="/pic/abs.twimg.com%2Fsticky%2Fdefault_profile_images%2Fdefault_profile_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/lowmal3" title="lowmal">lowmal</a>
                        <a class="username" href="/lowmal3" title="@lowmal3">@lowmal3</a>
                      </div>
                      <span class="tweet-date"><a href="/lowmal3/status/1577709708269469697#m" title="Oct 5, 2022 · 5:18 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/Alh4zr3d">@Alh4zr3d</a> <a href="/c_APT_ure">@c_APT_ure</a></div>
                <div class="tweet-content media-body" dir="auto">unset HISTFILE should be enough, you don‘t have to redirect to /dev/null. But the masking a command as syslogd is really nice.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 8</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/Alh4zr3d/status/1577710501085081600#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/Alh4zr3d"><img class="avatar round" src="/pic/profile_images%2F1261794478450331648%2FBAyT3XZw_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/Alh4zr3d" title="Alh4zr3d">Alh4zr3d</a>
                        <a class="username" href="/Alh4zr3d" title="@Alh4zr3d">@Alh4zr3d</a>
                      </div>
                      <span class="tweet-date"><a href="/Alh4zr3d/status/1577710501085081600#m" title="Oct 5, 2022 · 5:21 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">I find unset HISTFILE to be more likely to be logged, given it's the usual way to accomplish this. My way is more unique and less likely to be predicted, but accomplishes the same goal.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 3</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 8</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item more-replies"><a class="more-replies-text" href="/Alh4zr3d/status/1577710501085081600#m">more replies</a></div>
          </div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/bakertechsrvcs/status/1577710485348257808#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/bakertechsrvcs"><img class="avatar round" src="/pic/profile_images%2F1533919537015447555%2F2MxGXOqn_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/bakertechsrvcs" title="Baker Technology Services">Baker Technology Services</a>
                        <a class="username" href="/bakertechsrvcs" title="@bakertechsrvcs">@bakertechsrvcs</a>
                      </div>
                      <span class="tweet-date"><a href="/bakertechsrvcs/status/1577710485348257808#m" title="Oct 5, 2022 · 5:21 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/Alh4zr3d">@Alh4zr3d</a></div>
                <div class="tweet-content media-body" dir="auto">Interesting stuff (especially the syslogd masking!) - into my research notes it goes <a href="/search?q=%23btseyeonsecurity">#btseyeonsecurity</a></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 2</div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/alijnclarke/status/1577712394490581000#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/alijnclarke"><img class="avatar round" src="/pic/profile_images%2F1567091013788786688%2FwzkQOzdJ_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/alijnclarke" title="Ali">Ali</a>
                        <a class="username" href="/alijnclarke" title="@alijnclarke">@alijnclarke</a>
                      </div>
                      <span class="tweet-date"><a href="/alijnclarke/status/1577712394490581000#m" title="Oct 5, 2022 · 5:28 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/Alh4zr3d">@Alh4zr3d</a> <a href="/akaclandestine">@akaclandestine</a></div>
                <div class="tweet-content media-body" dir="auto"><a href="/SaveToNotion" title="Save to Notion ">@SaveToNotion</a> <a href="/search?q=%23Thread">#Thread</a> <a href="/search?q=%23RedTeam">#RedTeam</a></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/ard3n00/status/1577716419256619024#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/ard3n00"><img class="avatar round" src="/pic/profile_images%2F1561994211129442304%2F4zIW4P1D_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/ard3n00" title="ztur">ztur</a>
                        <a class="username" href="/ard3n00" title="@ard3n00">@ard3n00</a>
                      </div>
                      <span class="tweet-date"><a href="/ard3n00/status/1577716419256619024#m" title="Oct 5, 2022 · 5:44 PM UTC">Oct 5</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/Alh4zr3d">@Alh4zr3d</a></div>
                <div class="tweet-content media-body" dir="auto">Instead of exiting shell via exit. Do kill -9 $$ ;)</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 6</div></span>
                </div>
              </div>
            </div></div>
          <div class="show-more"><a href="?cursor=LBmGkMC89YnElOUroMC82fnUk%2BUrgoCygdynk%2BUrgMC8iZ%2F2%2F%2BQrgICx6Zug%2BOQrgMC%2Btc2S%2BuQroMC84ayuluUrgICx0ZqOguUrJQISAAA%3D#r">Load more</a></div>
        </div>
        <div class="top-ref"><div class="icon-container"><a class="icon-down" title="" href="#m"></a></div></div>
      </div></div>
  </body>
</html>